A processing system may include hardware resources, such as a central processing unit (CPU), random access memory (RAM), and nonvolatile memory. The processing system may also include software resources, such as a basic input/output system (BIOS), a virtual machine monitor (VMM), and one or more guest operating systems (OSs) running on the VMM. When the computer system is started or reset, it may load the BIOS, and then the VMM. The VMM may then create one or more virtual machines, and the virtual machines may boot to different OSs or to different instances of the same OS.
In addition to RAM and one or more CPUs, a processing system may include a security coprocessor, such as a trusted platform module (TPM). A TPM is a hardware component that resides within a processing system and provides various facilities and services for enhancing the security of the processing system. For example, a TPM may be implemented as an integrated circuit (IC) or semiconductor chip, and it may be used to protect data and to attest to the configuration of a platform. A TPM may be implemented in accordance with specifications such as the Trusted Computing Group (TCG) TPM Specification Version 1.2, dated Oct. 2, 2003 (hereinafter the “TPM specification”), which includes parts such as Design Principles, Structures of the TPM, and TPM Commands. The TPM specification is published by the TCG and is available from the Internet at www.trustedcomputinggroup.org/home.
The sub-components of a TPM may include an execution engine and secure nonvolatile (NV) memory or storage. The secure NV memory is used to store sensitive information, such as encryption keys, and the execution engine protects the sensitive information according to the security policies dictated by the TPM's control logic.
In general, a TCG-compliant TPM provides security services such as attesting to the identity and/or integrity of the platform, based on characteristics of the platform. The platform characteristics typically considered by a TPM include hardware components of the platform, such as the processor(s) and chipset, as well as the software residing in the platform, such as the firmware and OS. A TPM may also support auditing and logging of software processes, as well as verification of platform boot integrity, file integrity, and software licensing. A TPM may therefore be considered the root of trust for a platform.